Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Checklist Editor for Heimdall #3315

Draft
wants to merge 570 commits into
base: master
Choose a base branch
from
Draft

Checklist Editor for Heimdall #3315

wants to merge 570 commits into from

Conversation

Rlin232
Copy link
Contributor

@Rlin232 Rlin232 commented Jul 11, 2022

  • UI/UX:

    • Fix small table view
    • Address Add None to the Severity Counts Summary #4734
    • Make left-right column height match up
    • Drop down list on the sidebar should be radio buttons instead of checkboxes
    • When you filter and manage to exclude all the stig rules, it still shows the last viewed rule on the right side {Fixed in checklistView-Filtering}
    • Make aesthetics match (rules table dropdown is blue for some reason) {Fixed in checklistView-Filtering}
    • Other UI issues (selected columns tag buttons don't fit properly at certain resolutions/scales) {Fixed in checklistView-Filtering}
  • Improve filtering (Completed in checklistView-Filtering):

    • Add search parsing for new attributes (vul id, rule id, stig id, classification, groupname, CCIs)
    • Can filter rules by vul id, rule id, stig id, classification, groupname, CCIs, status, severity in search bar
    • Can filter by inclusive and exclusive
    • Implement new query parsing dependency
    • Improve user experience with toggle filtering on status and severity with switches
    • Document functions that are used or created
    • Create test file for Checklist view
    • Update test file for Sidebar component to test filtering
    • Move filtering functionality into the Vuex Store
    • Update help modal to reflect functionality of new query parser (e.g., exclusive filtering, handling white space, no more need for quotes around the whole term)
    • Fix any errors that arise from changing how filters are stored (e.g., Compare view)
    • Start documentation generation process
    • Add filter on NIST control families (e.g. "AU", "AT", etc.)
  • Fix These

    • When the Results, Profiles, or Checklist folding group is click, it opens the Panel (displays the Heimdall for the selected group) this is not the expected behavior - expect the group panel to open.

    • Update the Quick Filters (I would change the name to Common Filter Options and center the title) to be more informative that the filters belong to all types of scans (Results, Profiles, and Checklists) - Make a border around the panel to distinguished that the filter is common to all group selections.

    • When opening the Checklist panel the two panels displayed are not aligned top.
      image

    • When opening the Checklist panel nothing is displayed until you click on the Short ID slider (see image above).

    • Make the Rules display panel high to match the Heimdall main frame (minus some padding for good aesthetics)

    • Ensure that the horizontal scrollbar is displayed after fixing the vertical high an scrolling

    • Unable to read bottom potion of the STIG control
      image
      image
      image

    • No STIG information is displayed (STIG ID, Bule ID, Group Name, etc)
      image

    • Visual bug with filtering rules by keywords logic - adding two filters whose filter "keyword" is the same but each is an inclusive filter and an exclusive filter. Selecting one of the filters to remove results in both being selected, but only the "truly" selected filter is removed. Attempting to click "Remove filter" with the remaining formerly-duplicate-word filter does not work, as if it were not "truly" selected. Deselecting one of the two "duplicates" deselects both "duplicates". In STIGViewer 2.18, adding an exclusive filter and attempting to add an inclusive filter (or vice versa) with the same keyword is not allowed. In Vue, this causes a warning: hook.js:608 [Vue warn]: Duplicate keys detected: '<duplicate string>'. This may cause an update error.

    • Bug with filtering rules by keywords logic - Not selecting a filter property in either the Checklist Filters or Category Filters uses a default filter property of "keywords", even though "keywords" is not selectable in Checklist Filters. However, the search bar will show a key:value comma-separated string indicating that the key is missing if the filter property wasn't selected.

    • ChecklistSeverityOverride.vue - gets

ChecklistSeverityOverride.vue:48 
 [Vue warn]: Missing required prop: "severityOverrideSelection"

found in

---> <ChecklistSeverityOverride> at src/components/global/checklist/ChecklistSeverityOverride.vue
       <VThemeProvider>
         <VBottomSheet>
           <VMain>
             <Base> at src/views/Base.vue
               <Checklist> at src/views/Checklist.vue
                 <VApp>
                   <App> at src/App.vue
                     <Root>
Promise.then		
validateSecurityJustification	@	ChecklistSeverityOverride.vue:48
Show 31 more frames
hook.js:608 
 [Vue warn]: Error in v-on handler: "TypeError: Cannot read properties of undefined (reading 'valueOf')"

found in

---> <VSelect>
       <VCard>
         <ChecklistRuleInfoBody> at src/components/global/checklist/ChecklistRuleEdit.vue
           <VMain>
             <Base> at src/views/Base.vue
               <Checklist> at src/views/Checklist.vue
                 <VApp>
                   <App> at src/App.vue
                     <Root>
Show 24 more frames

when selecting a severity override different from default on first load of a control

  • The following error
hook.js:608  TypeError: Cannot read properties of undefined (reading 'valueOf')
    at VueComponent.promptSeverityJustification (ChecklistRuleEdit.vue:105:1)
    at invokeWithErrorHandling (vue.runtime.esm.js:3033:1)
    at VueComponent.invoker (vue.runtime.esm.js:1832:1)
    at invokeWithErrorHandling (vue.runtime.esm.js:3033:1)
    at Vue.$emit (vue.runtime.esm.js:3732:1)
    at VueComponent.setValue (VSelect.js:813:1)
    at VueComponent.selectItem (VSelect.js:767:1)
    at invokeWithErrorHandling (vue.runtime.esm.js:3033:1)
    at VueComponent.invoker (vue.runtime.esm.js:1832:1)
    at invokeWithErrorHandling (vue.runtime.esm.js:3033:1)

happens when you pick a severity override that is equal to the default (after you select a severity override at first that is different from the default) AND under Misc Data, the Severity Override Justification: does not reset when you select the default severity override.

  • The Clear Selection button's text disappears when the window width is 959 px.
    image
    image

  • Tests:

    • Cypress tests
    • HDF converters tests
  • Other Improvements

    • Verify if saving to the database works correctly
    • Export ckl to csv
    • Move jsonix generated mapping into hdf converters
    • Severity override should make it '$severity (default)' not just '(default)'
    • Split hdf converters part into two in order to match typical converter structure
  • Move To Separate PR

    • Input validation for 'target data' fields (Make sure to sanitize string input) {Move to seperate PR}
    • Add modal to let user know their changes were saved (debounce typing, show modal after a little bit. keep the same save behavior where it just saves continuously tho, this is just a convenience thing for the user) {Move to seperate PR}
  • Support "Must match: All" filter matching from STIGViewer 2.18. Having more than 1 exclusive filter on Category Filters > Filter Properties breaks both exclusive filters. e.g. Keyword 366, Filter cci and Keyword 68, Filter cci results in the list of rules now containing those whose CCIs have 366 and 68. If there is only 1 exclusive filter in the list, then it works again. In the STIGViewer 2.18, the same filtering logic is found when selecting the "Must match: Any" option, but not in the "Must match: All" option.

image image

@Amndeep7 Amndeep7 temporarily deployed to heimdall2-checklistview-ffdivu July 11, 2022 22:59 Inactive
@Amndeep7 Amndeep7 temporarily deployed to heimdall2-checklistview-ffdivu July 12, 2022 00:12 Inactive
@Amndeep7 Amndeep7 temporarily deployed to heimdall2-checklistview-ffdivu July 12, 2022 18:08 Inactive
@camdenmoors camdenmoors temporarily deployed to heimdall2-checklistview-ffdivu July 12, 2022 18:35 Inactive
@camdenmoors camdenmoors temporarily deployed to heimdall2-checklistview-ffdivu July 12, 2022 19:02 Inactive
@Amndeep7 Amndeep7 temporarily deployed to heimdall2-checklistview-ffdivu July 12, 2022 22:28 Inactive
@lgtm-com
Copy link

lgtm-com bot commented Jul 19, 2022

This pull request introduces 3 alerts when merging fc051a8 into eee1cb1 - view on LGTM.com

new alerts:

  • 3 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 19, 2022

This pull request introduces 3 alerts when merging a6a2f79 into eee1cb1 - view on LGTM.com

new alerts:

  • 3 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 20, 2022

This pull request introduces 4 alerts when merging 77ec2cb into 57f603f - view on LGTM.com

new alerts:

  • 4 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 20, 2022

This pull request introduces 4 alerts when merging 4ad6979 into 57f603f - view on LGTM.com

new alerts:

  • 4 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 21, 2022

This pull request introduces 3 alerts when merging ede31f4 into b394c65 - view on LGTM.com

new alerts:

  • 3 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 22, 2022

This pull request introduces 1 alert when merging d11ca35 into d27d295 - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@mergify
Copy link
Contributor

mergify bot commented Jul 22, 2022

This pull request has a conflict. Could you fix it @Rlin232?

@lgtm-com
Copy link

lgtm-com bot commented Jul 29, 2022

This pull request introduces 1 alert when merging c487e1e into a47500a - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 29, 2022

This pull request introduces 1 alert when merging 10d5773 into a47500a - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 29, 2022

This pull request introduces 1 alert when merging e5a69d3 into a47500a - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 30, 2022

This pull request introduces 1 alert when merging 5e597f1 into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 30, 2022

This pull request introduces 1 alert when merging 04d2d0a into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Jul 30, 2022

This pull request introduces 1 alert when merging 026733b into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Aug 1, 2022

This pull request introduces 1 alert when merging d4c9e5a into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Aug 1, 2022

This pull request introduces 1 alert when merging f5299cd into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Aug 1, 2022

This pull request introduces 1 alert when merging c4c4ccf into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Aug 2, 2022

This pull request introduces 1 alert when merging a1a70d2 into b5ee02f - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Aug 2, 2022

This pull request introduces 1 alert when merging b91e7b1 into 06ac9f3 - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@lgtm-com
Copy link

lgtm-com bot commented Aug 2, 2022

This pull request introduces 1 alert when merging 1c9cd79 into 75e076a - view on LGTM.com

new alerts:

  • 1 for Unused variable, import, function or class

@sonarqubecloud
Copy link

SonarCloud Quality Gate failed.    Quality Gate failed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 3 Code Smells

No Coverage information No Coverage information
1.4% 1.4% Duplication

@ejaronne
Copy link
Contributor

ejaronne commented Nov 2, 2022

Are future features going to include:

  • loading any supported security data into the main "results" view, then being able to simply switch it over into checklist viewer instead of having to export it to .ckl and then reload it?
  • be able to export any of those samples in Heimdall to ckl and have them properly view in checklist viewer? Currently they don't seem to work...

@Amndeep7
Copy link
Contributor

Amndeep7 commented Nov 3, 2022

@ejaronne Can you make the first bullet point a new issue? W/r to the second one, there's definitely issues with the hdf2ckl mappers that I haven't had an opportunity to fix.

@ejaronne
Copy link
Contributor

ejaronne commented Nov 3, 2022

#3719

Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
…SON file and check in that file

Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
… static analysis tags if there are already existing found NIST tags and/or mapped CCI->NIST tags

Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
…lt NIST and CCI tags discussion

Signed-off-by: Joyce Quach <[email protected]>
…ONIX is an empty string representing the serialized CCI tags

Signed-off-by: Joyce Quach <[email protected]>
Signed-off-by: Joyce Quach <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.